Linux kernel (arch/x86/kernel/fpu): A guest that disables an XSAVE feature through XFD while the saved XSTATE_BV still

Impact

A guest that disables an XSAVE feature through XFD while the saved XSTATE_BV still advertises it makes the host execute XRSTOR with a state combination that raises #NM in kernel context and panics the machine. One tenant's WRMSR takes the entire node down, which in a shared GPU cluster is every co-resident tenant's outage.

Who can reach it

Guest-side: the guest writes MSR_IA32_XFD to disable a feature (AMX and friends) and wins a race against a host interrupt that triggers kernel_fpu_begin() before KVM updates the guest XFD. Requires an XFD-capable CPU (Sapphire Rapids-class AMX hardware) and any tenant VM on it. A second path is a VMM stuffing XSTATE_BV via KVM_SET_XSAVE, which needs /dev/kvm.

What to do

Update to a kernel with the referenced stable commits. Interim: do not expose AMX / XFD-gated features in the guest CPU model on unpatched nodes, which removes the guest's ability to set XFD at all.

References